为每个IP地址打印第一个和最后一个数据时间 script.awk input.log runnig:输出:

我有var / log / messages之类的

Nov  9 09:38:45 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.100 port 67 (xid=0x2edb1fe2)
Nov  9 09:38:45 jenkins dhclient[921]: DHCPACK from 192.168.0.100 (xid=0x2edb1fe2)
Nov  9 09:38:47 jenkins dhclient[921]: bound to 192.168.0.11 -- renewal in 6195 seconds.
Nov  9 11:22:02 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.100 port 67 (xid=0x2edb1fe2)
Nov  9 11:22:02 jenkins dhclient[921]: DHCPACK from 192.168.0.100 (xid=0x2edb1fe2)

我需要如下打印结果:

192.168.0.100
first datatime: 2013-11-09 09:38:45
last datatime: 2013-11-09 11:22:02

我知道如何分割我的IP地址。但是我该怎么打印,对我来说是个问题。我做了一个for循环,在我的IP列表中有每个IP。所以我只有这个:

str=( $(grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}' messages | sort -u )  );
for X in "${str[@]}"
do
 echo "$X"
 #print first data
 #print last data

done

fairhu 回答:为每个IP地址打印第一个和最后一个数据时间 script.awk input.log runnig:输出:

如破折号-o所述,您必须重新设置日期。 date命令可以做到这一点。

为避免对每个IP的日志文件进行昂贵的扫描,您还可以按IP和时间对日志文件进行排序。

最后,对于生成输出,awk是最好的工具。

尝试一下:

#!/bin/bash

logfile="messages"

while read line; do       # reformat output of log file

  day=$(date -d "${line:0:6}" +%Y-%m-%d)
  hour=${line:7:8}
  ip=$(echo "$line" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}')
  echo $ip $day $hour
                          # output IP,day and hour,space separated
done < $logfile | 
                          # sort this output,first by IP,then by date and time
sort |
                          # redirect sorted output to awk to format results
awk '
  { 
    if ($1 != current_ip) {
      if (last_datatime) {
        print "last datatime:  " last_datatime;
        print " "; /* empty line before new IP,remove code if not needed */
      }
      current_ip = $1; 
      print current_ip; 
      print "first datatime: "$2" "$3;
    } 
    last_datatime = $2" "$3; 
  }

  END {
    print "last datatime:  "last_datatime;
  }'
,

假设您的日志文件与每个IP的几行一致。

我们可以使用以下awk脚本:

不需要排序,时间戳按它们在每个IP中在日志中注册的顺序排列。 ip行可以混合。

从问题上讲,年份未输入,对当前年份进行硬编码。

使用输入变量更好地传递currYear! awk -v currYear=2019 -f script.awk input.log

script.awk

BEGIN { # pre processing before reading input file
    currYear=2019; # hard code the current year,better provide as an input variable
    # define array for 12 months
    months["Jan"]="01";months["Feb"]="02";months["Mar"]="03";months["Apr"]="04";months["May"]="05";months["Jun"]="06";months["Jul"]="07";months["Aug"]="08";months["Sep"]="09";months["Oct"]="10";months["Nov"]="11";months["Dec"]="12";
}
/DHCPREQUEST/ { # process only lines having "DHCPREQUEST"
    ip = $10;  # extract ip variable from 10nth input
    if (ip in seenIpArr) { # if ip was seen already
        lastSeenIpArr[ip]++; # increment counter array for each seen ip,in lastSeenIpArr array
    } else { # if first time seeing this ip
        seenIpArr[ip] = lastSeenIpArr[ip] = 1; # register this ip in seenIpArr,reset this ip lastSeenIpArr to 1
    }
    ipTimeArr[ip,lastSeenIpArr[ip]] = $1OFS$2OFS$3; # save the current ip timestamp
}
END { # post processing after reading input file
    for (i in seenIpArr) { # for each seen ip (not ordered)
        printf ("%s%s%s",ORS,i,ORS); # print newline,current ip,newline
        split(ipTimeArr[i,1],a); # split the current ip first timestamp fields into array a
        printf ("first datatime: %d-%d-%02d %s%s",currYear,months[a[1]],a[2],a[3],ORS); # print the formated timestamp
        split(ipTimeArr[i,lastSeenIpArr[ip]],a); # split the current ip last timestamp fields into array a
        printf ("last datatime: %d-%d-%02d %s%s",ORS); # print the formated timestamp
    }
}

input.log

Nov  9 09:38:45 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.100 port 67 (xid=0x2edb1fe2)
Nov  9 09:38:45 jenkins dhclient[921]: DHCPACK from 192.168.0.100 (xid=0x2edb1fe2)
Nov  9 09:38:47 jenkins dhclient[921]: bound to 192.168.0.11 -- renewal in 6195 seconds.
Nov  9 07:38:45 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.101 port 67 (xid=0x2edb1fe2)
Nov  9 07:38:45 jenkins dhclient[921]: DHCPACK from 192.168.0.101 (xid=0x2edb1fe2)
Nov  9 07:38:47 jenkins dhclient[921]: bound to 192.168.0.11 -- renewal in 6195 seconds.
Nov  9 09:38:46 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.100 port 67 (xid=0x2edb1fe2)
Nov  9 09:38:46 jenkins dhclient[921]: DHCPACK from 192.168.0.100 (xid=0x2edb1fe2)
Nov  9 09:38:48 jenkins dhclient[921]: bound to 192.168.0.11 -- renewal in 6195 seconds.
Nov  9 11:22:02 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.100 port 67 (xid=0x2edb1fe2)
Nov  9 11:22:02 jenkins dhclient[921]: DHCPACK from 192.168.0.100 (xid=0x2edb1fe2)
Nov  9 09:39:45 jenkins dhclient[921]: DHCPREQUEST on eth0 to 192.168.0.101 port 67 (xid=0x2edb1fe2)
Nov  9 09:39:45 jenkins dhclient[921]: DHCPACK from 192.168.0.101 (xid=0x2edb1fe2)
Nov  9 09:39:47 jenkins dhclient[921]: bound to 192.168.0.11 -- renewal in 6195 seconds.

runnig:

awk -f script.awk input.log

输出:

192.168.0.100
first datatime: 2019-11-09 09:38:45
last datatime: 2019-11-09 09:38:46

192.168.0.101
first datatime: 2019-11-09 07:38:45
last datatime: 2019-11-09 09:39:45
本文链接:https://www.f2er.com/3100622.html

大家都在问